feat(web): improve PR and diff review workflows

apps/mobile/src/features/review/reviewModel.test.ts

@@ -133,6 +133,35 @@ describe("buildReviewSectionItems", () => {
     ]);
     expect(getDefaultReviewSectionId(items)).toBe("git:working-tree");
   });
+
+  it.each([
+    ["staged", "Staged changes", "Changes staged for commit"],
+    ["unstaged", "Unstaged changes", "Changes not staged for commit"],
+  ] as const)("keeps the %s source distinct from branch changes", (kind, title, subtitle) => {
+    const diff = `diff --git a/${kind}.ts b/${kind}.ts`;
+    const items = buildReviewSectionItems({
+      checkpoints: [],
+      gitSections: [
+        {
+          id: kind,
+          kind,
+          title,
+          baseRef: kind === "staged" ? "HEAD" : null,
+          headRef: null,
+          diff,
+          diffHash: kind,
+          truncated: false,
+        },
+      ],
+      turnDiffById: {},
+      loadingTurnIds: {},
+      loadingGitSections: false,
+    });
+    expect(items).toMatchObject([
+      { id: `git:${kind}`, kind, title, subtitle, diff, isLoading: false },
+    ]);
+    expect(getDefaultReviewSectionId(items)).toBe(`git:${kind}`);
+  });
 });
 
 describe("buildReviewParsedDiff", () => {

apps/mobile/src/features/review/reviewModel.ts

@@ -6,7 +6,7 @@ import * as Arr from "effect/Array";
 import { pipe } from "effect/Function";
 import * as Order from "effect/Order";
 
-export type ReviewSectionKind = "turn" | "working-tree" | "branch-range";
+export type ReviewSectionKind = "turn" | ReviewDiffPreviewSource["kind"];
 
 const DIRTY_WORKTREE_SECTION_ID = "git:working-tree";
 const DIRTY_WORKTREE_TITLE = "Dirty worktree";
@@ -125,6 +125,12 @@ function gitSubtitle(section: ReviewDiffPreviewSource): string | null {
   if (section.kind === "working-tree") {
     return DIRTY_WORKTREE_SUBTITLE;
   }
+  if (section.kind === "staged") {
+    return "Changes staged for commit";
+  }
+  if (section.kind === "unstaged") {
+    return "Changes not staged for commit";
+  }
   if (section.baseRef) {
     return `${section.baseRef} ... ${section.headRef ?? "HEAD"}`;
   }

apps/server/src/assets/AssetAccess.test.ts

@@ -2,7 +2,12 @@
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import * as NodeHttpPlatform from "@effect/platform-node/NodeHttpPlatform";
 import * as NodeFSP from "node:fs/promises";
-import { AssetAccessError, AssetPreviewTypeValidationError, ThreadId } from "@t3tools/contracts";
+import {
+  AssetAccessError,
+  AssetPreviewTypeValidationError,
+  ProjectId,
+  ThreadId,
+} from "@t3tools/contracts";
 import { PROJECT_FAVICON_FALLBACK_MARKER } from "@t3tools/shared/projectFavicon";
 import { describe, expect, it } from "@effect/vitest";
 import * as Crypto from "effect/Crypto";
@@ -1169,3 +1174,37 @@ describe("AssetAccess", () => {
     }).pipe(Effect.provide(testLayer)),
   );
 });
+
+it.effect("signs private media with its PR scope and rejects other hosts", () =>
+  Effect.gen(function* () {
+    const reference = {
+      projectId: "p1" as ProjectId,
+      host: "gitlab.example",
+      repository: "owner/repo",
+      number: 7,
+      expectedAccountId: "selected-account",
+    };
+    const resource = {
+      _tag: "pull-request-media" as const,
+      reference,
+      provider: "gitlab" as const,
+      url: `/uploads/${"a".repeat(32)}/shot.png`,
+    };
+    const issued = yield* issueAssetUrl({ resource });
+    const suffix = issued.relativeUrl.slice(`${ASSET_ROUTE_PREFIX}/`.length);
+    const separator = suffix.indexOf("/");
+    expect(
+      yield* resolveAsset(suffix.slice(0, separator), suffix.slice(separator + 1)),
+    ).toMatchObject({
+      kind: "pull-request-media",
+      reference,
+      provider: "gitlab",
+      url: `https://gitlab.example/owner/repo${resource.url}`,
+      expiresAt: issued.expiresAt,
+    });
+    const invalid = yield* issueAssetUrl({
+      resource: { ...resource, url: `https://other.example${resource.url}` },
+    }).pipe(Effect.flip);
+    expect(invalid._tag).toBe("AssetPullRequestMediaUrlValidationError");
+  }).pipe(Effect.provide(testLayer)),
+);

apps/server/src/assets/AssetAccess.ts

@@ -2,6 +2,9 @@ import type { AssetResource } from "@t3tools/contracts";
 import {
   AssetAttachmentNotFoundError,
   AssetGitHubMediaUrlValidationError,
+  AssetPullRequestMediaUrlValidationError,
+  PullRequestRef,
+  SourceControlProviderKind,
   AssetPreviewTypeValidationError,
   AssetProjectFaviconInspectionError,
   AssetProjectFaviconNotFoundError,
@@ -28,6 +31,7 @@ import {
   readImageDimensions,
   type ImageDimensions,
 } from "@t3tools/shared/imageDimensions";
+import { pullRequestMediaUrl } from "@t3tools/shared/pullRequestMedia";
 import { githubMediaFetchUrl, githubMediaFileName } from "@t3tools/shared/githubMedia";
 import { PROJECT_FAVICON_FALLBACK_MARKER } from "@t3tools/shared/projectFavicon";
 import * as Clock from "effect/Clock";
@@ -83,6 +87,14 @@ const PREVIEW_ASSET_EXTENSIONS = new Set([
 ]);
 
 const AssetClaimsSchema = Schema.Union([
+  Schema.Struct({
+    version: Schema.Literal(1),
+    kind: Schema.Literal("pull-request-media"),
+    reference: PullRequestRef,
+    provider: SourceControlProviderKind,
+    url: Schema.String,
+    expiresAt: Schema.Number,
+  }),
   Schema.Struct({
     version: Schema.Literal(1),
     kind: Schema.Literal("workspace-file"),
@@ -153,6 +165,7 @@ const decodeAssetClaims = Schema.decodeUnknownOption(AssetClaimsJson);
 const encodeAssetClaims = Schema.encodeSync(AssetClaimsJson);
 
 export type ResolvedAsset =
+  | Extract<AssetClaims, { readonly kind: "pull-request-media" }>
   | {
       readonly kind: "file";
       readonly path: string;
@@ -676,6 +689,26 @@ export const issueAssetUrl = Effect.fn("AssetAccess.issueAssetUrl")(function* (i
       fileName = "native-app-icon.png";
       break;
     }
+    case "pull-request-media": {
+      const resource = input.resource;
+      const url = pullRequestMediaUrl({
+        ...resource.reference,
+        provider: resource.provider,
+        host: resource.reference.host,
+        url: resource.url,
+      });
+      if (url === null) return yield* new AssetPullRequestMediaUrlValidationError({});
+      claims = {
+        version: 1,
+        kind: "pull-request-media",
+        reference: resource.reference,
+        provider: resource.provider,
+        url,
+        expiresAt,
+      };
+      fileName = githubMediaFileName(url);
+      break;
+    }
     case "github-media": {
       const fetchUrl = githubMediaFetchUrl(input.resource.url);
       if (fetchUrl === null) {
@@ -791,6 +824,8 @@ export const resolveAsset = Effect.fn("AssetAccess.resolveAsset")(function* (
       : null;
   }
 
+  if (claims.kind === "pull-request-media") return claims;
+
   if (claims.kind === "github-media") {
     return {
       kind: "github-media",

apps/server/src/assets/GitHubMediaFetch.ts

@@ -1,5 +1,6 @@
 import * as Mime from "effect/unstable/http/Mime";
 import { githubMediaFileName } from "@t3tools/shared/githubMedia";
+import { isPullRequestMediaRedirectAllowed } from "@t3tools/shared/pullRequestMedia";
 import * as Clock from "effect/Clock";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
@@ -131,8 +132,9 @@ const fetchFollowingRedirects = Effect.fn("GitHubMediaFetch.fetchFollowingRedire
     if (response.status < 300 || response.status >= 400) return response;
     // A chain this long is not GitHub answering with bytes, and its body is not the media.
     if (!location || hop >= MAX_REDIRECTS) return null;
-    const next = new URL(location, target);
-    if (next.protocol !== "https:") return null;
+    const next = URL.parse(location, target);
+    if (next === null || !isPullRequestMediaRedirectAllowed("github", new URL(url).origin, next))
+      return null;
     target = next.toString();
   }
 });
@@ -153,6 +155,13 @@ export const githubMediaResponse = Effect.fn("GitHubMediaFetch.githubMediaRespon
     if (value !== undefined) forwarded[name] = value;
   }
   const response = yield* fetchFollowingRedirects(asset.url, forwarded, token);
+  return yield* mediaResponse(asset, response);
+});
+
+export const mediaResponse = Effect.fn("GitHubMediaFetch.mediaResponse")(function* (
+  asset: { readonly url: string; readonly expiresAt: number },
+  response: HttpClientResponse.HttpClientResponse | null,
+) {
   // An upload GitHub hosts never changes under its URL, so the only thing a cached copy must
   // not outlive is the signed URL that granted it — which is the same bound the URL itself has.
   const remainingSeconds = Math.floor((asset.expiresAt - (yield* Clock.currentTimeMillis)) / 1000);